本地运行SSH守护进程时，如何无需建立网络连接且不使用ssh-keyscan获取其指纹？

Great question! If you need to grab your local SSH daemon's fingerprint without any network connections or using ssh-keyscan, there are two straightforward, reliable methods you can use right on your machine:

Method 1: Generate the fingerprint directly from SSH host key files #

The SSH daemon stores its host keys in the /etc/ssh/ directory by default. These keys come in pairs (private and public) with names like ssh_host_rsa_key, ssh_host_ecdsa_key, or ssh_host_ed25519_key (each corresponding to a different encryption algorithm). You can use the built-in ssh-keygen tool to extract the fingerprint from these files—no network required.

• First, list all available host key files to see which algorithms your daemon uses:

  ls -l /etc/ssh/ssh_host_*_key
  

• Next, generate the fingerprint for a specific key. For example, to get the RSA key fingerprint:

  ssh-keygen -lf /etc/ssh/ssh_host_rsa_key
  

  You can also use the public key file (the one with .pub suffix) for the same result:

  ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub
  

  The output will look something like this:

  2048 SHA256:abcdef1234567890abcdef1234567890abcdef1234567890 root@localhost (RSA)
  The SHA256:xxx string is your SSH daemon's fingerprint.

Method 2: Retrieve the fingerprint from system logs #

When the SSH daemon starts up, it typically logs its host key fingerprints to the system log. You can pull this information directly from your log files without any network activity.

• For systems using systemd (like Ubuntu 16.04+, CentOS 7+, Fedora), use journalctl to filter the SSH daemon logs:

  journalctl -u sshd | grep -E "fingerprint|SHA256"
  

• For systems using traditional syslog, check the authentication log file (location varies by distro):

  # Debian/Ubuntu-based systems
  grep -E "fingerprint|SHA256" /var/log/auth.log
  
  # RHEL/CentOS-based systems
  grep -E "fingerprint|SHA256" /var/log/secure
  

  You'll see log entries that include the fingerprint, similar to this:

  Sep 10 10:00:00 localhost sshd[1234]: RSA host key fingerprint is SHA256:abcdef1234567890abcdef1234567890abcdef1234567890.

Both methods work entirely locally, no network connections needed, and avoid using ssh-keyscan as requested.

内容的提问来源于stack exchange，提问作者bilogic